# Endpoint Agent two host showing in logs-\* per host

**URL:** <https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551>\
**Category:** Beats\
**Tags:** elastic-agent\
**Created:** [January 19, 2021, 1:53pm UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551 "2021-01-19T13:53:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [January 19, 2021, 1:53pm UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551/1 "2021-01-19T13:53:42Z")

</div>

Re-created with elastic-agent tag for better visibility.

Hi,

I have recently been rolling out the Endpoint agent to some host for testing.  
Within the fleet agents tab, there is a single entry for each host in the format "hostname".

However within the logs-\* index there are two host names for each host in the following formats, "hostname" and "hostname.domain.name.here" .

This is then showing as two separate hosts under the SIEM hosts location.

Any idea as to what could be causing this ?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [January 20, 2021, 9:10am UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551/2 "2021-01-20T09:10:25Z")

</div>

Would you mind posting a Kibana screenshot and/or dump of Elasticsearch index (relevant dumps)?

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [January 20, 2021, 10:58am UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551/3 "2021-01-20T10:58:51Z")

</div>

Hi @mtojek,

Thanks for getting back to me.

Below is the list of test agents I have deployed using fleet.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/713582f0dd931b92ad520bddc94a60610ca9c51e.png)

Here is a screen grab from the logs-\* index , you can see i could filter by host.hostname:"IPPLAP067" but IPPLAP067.ipperf.local is also available in the index

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cd2f918493f12e975750f87482c42f2e82049c81.png)

Finally here is the data in the SIEM app which pulls from this log clearly showing the two host names also with different features.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22cafcd48f84463ffd930f4b602c1d27f5d84f8c.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2021, 12:58pm UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551/4 "2021-02-17T12:58:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.